{"id":"CVE-2026-123863","kind":"vulnerability","aliases":["CVE-2026-123863"],"related":[],"title":"Node.js: HTTP/2 session teardown assertion lets any client crash server","description":"A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).","summary":"A crafted HTTP/2 request sequence makes Node.js hit an internal assertion during session teardown, terminating the process. An unauthenticated client can repeat this to take the server down over TLS or cleartext HTTP/2.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http2","node.js","runtime","self-hosted"],"not_affected_if":["no-http2-server","older-node-versions"],"how_to_check":"- Run `node --version` and check whether it is 26.x at or after 26.9.0, or 24.x at or after 24.22.0.\n- Look for `http2.createServer` or `http2.createSecureServer` in your application code, where handlers respond before the request body has finished.","fix":"- Node.js 26.x: `26.9.0` or later per the affected range; the fixed version for 26.x is not stated beyond the affected range.\n- Node.js 24.x: move past `24.22.0` (the affected range starts there); the exact fixed release is not stated in the sources.","status":"open","published_at":"2026-11-11T19:17:32+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","triaged_at":"2026-11-11T19:29:55+00:00","updated_at":"2026-11-11T19:29:55+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T19:29:55Z","model":"claude-haiku-5-5","output":{"fix":"- Node.js 26.x: `26.9.0` or later per the affected range; the fixed version for 26.x is not stated beyond the affected range.\n- Node.js 24.x: move past `24.22.0` (the affected range starts there); the exact fixed release is not stated in the sources.","reach":"internet","title":"Node.js: HTTP/2 session teardown assertion lets any client crash server","impact":"medium","summary":"A crafted HTTP/2 request sequence makes Node.js hit an internal assertion during session teardown, terminating the process. An unauthenticated client can repeat this to take the server down over TLS or cleartext HTTP/2.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","http2","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Any unauthenticated client repeatedly crashes the server process.","analyst_note":"Confirm the exact fixed Node.js releases for 26.x and 24.x from the Node.js security release notes; the sources only give affected starts.","how_to_check":"- Run `node --version` and check whether it is 26.x at or after 26.9.0, or 24.x at or after 24.22.0.\n- Look for `http2.createServer` or `http2.createSecureServer` in your application code, where handlers respond before the request body has finished.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-http2-server","older-node-versions"],"who_is_affected":"Servers running Node.js 26.x from 26.9.0 or 24.x from 24.22.0 that use the built-in HTTP/2 server, over TLS or cleartext. The trigger needs only a default http2 server whose handler responds before the request body ends, which the sources describe as typical. Applications that do not expose Node's HTTP/2 server are not described as exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000814,"input_tokens":4738,"output_tokens":680,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123863':13A,16A '-2024':156C '-2026':12A,15A '-27983':157C '0':124C '24':185C '24.22.0':188C '26':180C '26.9.0':183C 'abort':68C 'account':114C 'affect':178C 'alloc':88C 'arrang':79C 'assert':5A,33B,58C,125C 'bodi':144C 'buffer':90C 'check':119C 'cleartext':54B,75C 'client':8A,42B,67C,77C 'cover':164C 'craft':24B 'crash':9A 'current':121C 'cve':11A,14A,155C 'default':135C 'detach':107C,169C 'earlier':160C 'end':146C 'eq':120C 'fail':126C 'fix':161C,167C 'handler':139C 'header':89C 'hit':30B 'hold':85C 'host':22B 'http/2':2A,25B,55B,61C 'http2':17B,136C 'http2session':110C 'http2stream':82C 'intern':32B 'let':6A,64C 'make':28B 'memori':113C,123C 'need':132C 'never':106C 'nghttp2':87C,122C 'nghttp2-allocated':86C 'node.js':1A,18B,29B,60C,179C 'nonzero':116C 'outliv':92C 'process':39B,129C 'reachabl':57C 'remov':98C 'repeat':44B 'request':26B,143C 'respond':140C 'run':111C 'runtim':19B 'self':21B 'self-host':20B 'sequenc':27B 'server':10A,49B,70C,137C 'session':3A,35B,62C,94C,101C,175C 'set':104C 'sinc':182C,187C 'still':84C,171C 'stream':96C,103C,170C 'take':47B 'teardown':4A,36B,63C 'termin':37B,127C 'tls':52B,73C 'track':172C 'trigger':131C 'typic':149C 'unauthent':41B,66C 'variant':153C 'vulner':177C 'whose':138C 'x':181C,186C","nicknames":[],"mitigations":[],"who_affected":"Servers running Node.js 26.x from 26.9.0 or 24.x from 24.22.0 that use the built-in HTTP/2 server, over TLS or cleartext. The trigger needs only a default http2 server whose handler responds before the request body ends, which the sources describe as typical. Applications that do not expose Node's HTTP/2 server are not described as exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","http2","nodejs","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123863':13A,16A '-2026':12A,15A 'assert':5A 'client':8A 'crash':9A 'cve':11A,14A 'http/2':2A 'let':6A 'node.js':1A 'server':10A 'session':3A 'teardown':4A","search_b":"'assert':33B 'cleartext':54B 'client':42B 'craft':24B 'hit':30B 'host':22B 'http/2':25B,55B 'http2':17B 'intern':32B 'make':28B 'node.js':18B,29B 'process':39B 'repeat':44B 'request':26B 'runtim':19B 'self':21B 'self-host':20B 'sequenc':27B 'server':49B 'session':35B 'take':47B 'teardown':36B 'termin':37B 'tls':52B 'unauthent':41B","search_c":"'-2024':156C '-27983':157C '0':124C '24':185C '24.22.0':188C '26':180C '26.9.0':183C 'abort':68C 'account':114C 'affect':178C 'alloc':88C 'arrang':79C 'assert':58C,125C 'bodi':144C 'buffer':90C 'check':119C 'cleartext':75C 'client':67C,77C 'cover':164C 'current':121C 'cve':155C 'default':135C 'detach':107C,169C 'earlier':160C 'end':146C 'eq':120C 'fail':126C 'fix':161C,167C 'handler':139C 'header':89C 'hold':85C 'http/2':61C 'http2':136C 'http2session':110C 'http2stream':82C 'let':64C 'memori':113C,123C 'need':132C 'never':106C 'nghttp2':87C,122C 'nghttp2-allocated':86C 'node.js':60C,179C 'nonzero':116C 'outliv':92C 'process':129C 'reachabl':57C 'remov':98C 'request':143C 'respond':140C 'run':111C 'server':70C,137C 'session':62C,94C,101C,175C 'set':104C 'sinc':182C,187C 'still':84C,171C 'stream':96C,103C,170C 'teardown':63C 'termin':127C 'tls':73C 'track':172C 'trigger':131C 'typic':149C 'unauthent':66C 'variant':153C 'vulner':177C 'whose':138C 'x':181C,186C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123863","severity":null,"published_at":"2026-11-11T19:17:32+00:00","modified_at":"2026-11-11T19:17:32+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","fetched_at":"2026-11-11T19:28:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}